{"id":"CVE-2025-31486","published":"2025-04-03T18:24:39Z","modified":"2025-04-03T20:39:28Z","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","vendor":"vitejs","product":"vite","tier":"tail","description":{"text":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.40461,"percentile":0.98644,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290","tags":["x_refsource_MISC"]}],"priority":{"score":28.4,"factors":[{"name":"EPSS percentile","points":19.73},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-04-07","earliestUrl":"https://github.com/iSee857/CVE-2025-31486-PoC","repos":[{"name":"iSee857/CVE-2025-31486-PoC","url":"https://github.com/iSee857/CVE-2025-31486-PoC","stars":6,"created":"2025-04-07"},{"name":"ll104567/CVE-2025-31486","url":"https://github.com/ll104567/CVE-2025-31486","stars":0,"created":"2025-04-26"}]},"nuclei":[{"id":"CVE-2025-31486","name":"Vite server.fs.deny Bypass - Local File Inclusion","severity":"medium","path":"http/cves/2025/CVE-2025-31486.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31486.yaml"}],"first":{"date":"2025-04-07","source":"PoC-in-GitHub","url":"https://github.com/iSee857/CVE-2025-31486-PoC"},"provenance":"source"},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"vite","versions":["< 4.5.12",">=5.0.0, < 5.4.17",">=6.0.0, < 6.0.14",">=6.1.0, < 6.1.4",">=6.2.0, < 6.2.5"]}],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=6.2.0, <6.2.5",">=6.1.0, <6.1.4",">=6.0.0, <6.0.14",">=5.0.0, <5.4.17","<4.5.12"],"patched":["6.2.5","6.1.4","6.0.14","5.4.17","4.5.12"],"from":["GHSA-xcj6-pq6g-qj4x"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-9734","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vitejs-vite-cve-2022-35204","parents":[{"from":"CVE-2025-31125","to":"CVE-2025-31486","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"6.2.4","toFixed":"6.2.5","daysApart":3},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.11","toFixed":"4.5.12","daysApart":3},{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949","https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2024-45811","to":"CVE-2025-31486","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34","https://github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249","https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-30208","to":"CVE-2025-31486","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4","https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c","https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647"],"basis":"shared function","functions":["transformMiddleware"]}]}],"children":[{"from":"CVE-2025-31486","to":"CVE-2026-39364","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-31486","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]}],"packageHistory":[{"cve":"CVE-2025-24010","published":"2025-01-20","fixed":"6.0.9","kev":false},{"cve":"CVE-2025-30208","published":"2025-03-24","fixed":"6.2.3","kev":false},{"cve":"CVE-2025-31125","published":"2025-03-31","fixed":"6.2.4","kev":true},{"cve":"CVE-2025-31486","published":"2025-04-03","fixed":"6.2.5","kev":false},{"cve":"CVE-2025-32395","published":"2025-04-10","fixed":"6.2.6","kev":false,"link":{"from":"CVE-2025-31486","to":"CVE-2025-32395","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"6.2.5","toFixed":"6.2.6","daysApart":7},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.12","toFixed":"4.5.13","daysApart":7}]}},{"cve":"CVE-2025-46565","published":"2025-05-01","fixed":"6.3.4","kev":false},{"cve":"CVE-2026-118662","published":"2026-10-28","fixed":"6.4.5","kev":false}],"package":"npm:vite"}}